Privacy Policy
How Yoyopass collects, uses, and protects your personal data.
1. Data Controller
YOYO PASS S.A.P.I. DE C.V. (hereinafter, "Yoyopass" or "we"), domiciled in the State of Quintana Roo, Mexico, is the data controller for your personal data under the LFPDPPP.
Privacy contact: privacy@yoyopass.com
2. Personal Data We Collect
2.1. Data Provided Directly
- Identification data: Full name, email address, telephone number.
- Payment data: Processed exclusively through Stripe, Inc. (PCI-DSS certified). Yoyopass does NOT store card numbers.
- Tax data (optional): RFC, legal name, tax domicile for CFDI 4.0 invoice issuance.
2.2. Data Collected Automatically
- Location data: Approximate location from IP; precise GPS with consent.
- Device and browsing data: IP, browser type, OS, pages visited, session duration.
- Cookies: See our Cookie Policy for details.
2.3. Sensitive Data
Yoyopass does NOT collect sensitive personal data as defined by the LFPDPPP.
3. Purposes of Processing
3.1. Primary Purposes
- Process and confirm Digital Pass purchases.
- Generate and deliver QR codes.
- Share data with Operators for check-in (name, email, phone).
- Process refunds and cancellations.
- Issue CFDI 4.0 digital tax receipts.
- Provide customer service.
- Comply with legal and tax obligations.
- Prevent fraud and protect Platform security.
3.2. Secondary Purposes
- Marketing communications and newsletters.
- Personalized recommendations.
- Statistical and market analysis.
- Personalized advertising via third-party platforms.
To opt out, email privacy@yoyopass.com with subject "Opt-Out Secondary Purposes".
4. Third Parties We Share Data With
| Third Party | Data | Purpose |
|---|---|---|
| Tour operators | Name, email, phone | Reservation verification and check-in |
| Stripe, Inc. | Payment data | Secure payment processing (PCI-DSS) |
| Google LLC (GA4, GTM) | Browsing data, IP | Web analytics |
| Meta Platforms, Inc. | Browsing data, IP, events | Personalized advertising |
| TikTok (ByteDance) | Browsing data, IP, events | Personalized advertising |
| Mailchimp / Brevo | Email, name | Email marketing |
| Supabase, Inc. | All account data | Database, authentication |
| Vercel, Inc. | IP, performance data | Hosting, analytics |
| Sentry / LogRocket | Session data, errors | Error monitoring |
Yoyopass does not sell personal data to third parties.
5. International Data Transfers
Some providers may store data outside Mexico (including the U.S.). Transfers comply with LFPDPPP Articles 36-37. For EU visitors, GDPR-compliant mechanisms apply.
6. ARCO Rights
- Access: Know what data we hold and how we use it.
- Rectification: Correct inaccurate or incomplete data.
- Cancellation: Request data deletion.
- Opposition: Object to processing for specific purposes.
Contact privacy@yoyopass.com with your full name, description of rights, and ID copy. We respond within 20 business days.
7. Additional Rights for EU Visitors (GDPR)
- Data portability in structured, machine-readable format.
- Restriction of processing in certain circumstances.
- Not be subject to automated decisions.
- Withdraw consent at any time.
- Lodge a complaint with your data protection authority.
Legal basis (GDPR): (a) contract performance; (b) legal obligation; (c) legitimate interest; (d) consent.
8-13. Cookies, Retention, Minors, Security, Modifications, Contact
See our Cookie Policy for cookie details. Transaction data retained 5+ years (tax law). Account data retained while active + 2 years. We do not collect data from children under 16. We implement TLS/SSL encryption, RLS, Stripe webhook verification, and audit logging.
Privacy Officer: YOYO PASS S.A.P.I. DE C.V.
Email: privacy@yoyopass.com
Domicile: Quintana Roo, Mexico